Harbor

Harbor is a trusted cloud-native registry that extends Docker Distribution with enterprise-grade security and management features:

• Cloud Native Registry: Supports both container images and Helm charts.
• Role Based Access Control (RBAC): Manage permissions via 'projects' for images and charts.
• Policy Based Replication: Synchronize images/charts between registries using filters (repository, tag, label) with automatic retries.
• Vulnerability Scanning: Regular scanning and policy checks to prevent deployment of vulnerable images.
• Identity Management: Supports LDAP/AD integration and OpenID Connect (OIDC) for Single Sign-On (SSO).
• Image Lifecycle Management: Includes image deletion and garbage collection to free up space.
• Content Trust: Supports Notary for signing images to guarantee authenticity.
• Auditing: Tracks all repository operations through logs.
• API & UI: Provides a RESTful API with Swagger UI and a graphical user portal.

The Job Service tracks relationships between jobs using parent-child hierarchies. When a job launches a new job via the ctx.LaunchJob method, the new job is treated as a sub-job (execution) of the caller.

Key tracking properties:

• Parent Jobs: If a job has sub-jobs, its stats include an executions list containing the IDs of all sub-jobs and a multiple_executions flag set to true.
• Sub-jobs (Executions): Each sub-job contains an upstream_job_id property that points back to the ID of its parent job.

Job Kinds:

• Generic: Standard jobs.
• Scheduled: Jobs that run after a specific schedule_delay (in seconds).
• Periodic: A job template that is not run directly. Instead, the service clones the template to create real running jobs. Each execution of a periodic job has a unique ID but links to the template via upstream_job_id.

func (j *Job) Run(ctx job.Context, params job.Parameters) error{
    // Launching a sub-job (execution) of the current job
    subJob, err := ctx.LaunchJob(models.JobRequest{})
    // ...
    return nil
}

The harbor-backup script provides a way to back up Harbor components including the PostgreSQL database, Container Registry data, Chart Museum data, Redis data, Secret keys, and the harbor.yml configuration.

Prerequisites:

• Docker: The docker CLI must be installed and accessible.
• Permissions: You need sudo or docker group permissions.
• Stopped Harbor: You must stop your Harbor instance completely before running the backup to avoid data inconsistencies.

Workflow:

1. Make the script executable: chmod +x harbor-backup.
2. Stop the Harbor instance.
3. Run the script with desired options: ./harbor-backup [OPTIONS].

By default, the backup is created in a directory named harbor_backup in the current working directory. If --no-archive is not used, a compressed harbor_backup.tar.gz will be created inside that directory.

# Example: Backup with custom paths and no tarball archive
./harbor-backup \
  --db-path /custom/db/path \
  --registry-path /custom/registry/path \
  --backup-dir /mnt/backups/harbor_daily \
  --no-archive

To verify Harbor release artifacts, you must install Cosign (version 2.0 or later). Use the following commands based on your operating system:

macOS

Use Homebrew to install from the Sigstore tap.

Linux

Download the amd64 binary, make it executable, and move it to your path.

Windows (PowerShell)

Download the amd64 executable using Invoke-WebRequest.

After installation, verify it by running cosign version.

# macOS
brew install sigstore/tap/cosign

# Linux
curl -LO https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
chmod +x cosign-linux-amd64
sudo mv cosign-linux-amd64 /usr/local/bin/cosign

# Windows (PowerShell)
Invoke-WebRequest -Uri "https://github.com/sigstore/cosign/releases/latest/download/cosign-windows-amd64.exe" -OutFile "cosign.exe"

# Verify installation
cosign version

To execute the migration, run the compiled Docker image using the following command structure. You must provide the location of your existing chart data, the Harbor CA certificate (if using HTTPS), the Harbor hostname, and the admin password.

Required Parameters:

• {{your_chart_data_location}}: The local path to your chart storage (typically the chart_storage directory inside Harbor's data_volume).
• {{harbor_ca_cert_location}}: The path to the CA certificate required to connect to Harbor via HTTPS.
• {{harbor_hostname}}: The hostname of your Harbor instance.
• {{harbor_admin_password}}: The password for the Harbor admin user.

docker run -it --rm \
  -v {{your_chart_data_location}}:/chart_storage \
  -v {{harbor_ca_cert_location}}:/usr/local/share/ca-certificates/harbor_ca.crt \
  goharbor/migrate-chart:0.1.0 \
  --hostname {{harbor_hostname}} \
  --password {{harbor_admin_password}}

You can deploy Harbor to cloud providers (like DigitalOcean, AWS, or Azure) or on-premises environments using Docker Machine. This process involves creating a virtual machine, configuring DNS, setting up the Harbor configuration file, and using docker-compose to build and run the containers on the remote machine.

Workflow Steps:

1. Create the Virtual Machine: Use docker-machine create with your preferred driver and access token.
2. Configure DNS: Retrieve the machine's IP address using docker-machine ip and create a DNS entry at your provider pointing to that IP.
3. Prepare Configuration:
   • Copy Deploy/harbor.yml.tmp to Deploy/harbor.yml.
   • Update the hostname field in Deploy/harbor.yml to match your domain (e.g., harbor.mydomain.com).
   • Run the prepare script (as described in the Harbor Installation Guide).
4. Activate Environment: Use eval $(docker-machine env <machine_name>) to point your local Docker CLI to the remote machine.
5. Transfer Configuration Files: Create the directory structure on the remote machine and use docker-machine scp to copy the local config directory to the remote machine.
6. Build and Run: Execute docker-compose build followed by docker-compose up -d from within the Deploy directory.

# 1. Create the machine
docker-machine create --driver digitalocean --digitalocean-access-token <youraccesstoken> harbor.mydomain.com

# 2. Get IP for DNS configuration
docker-machine ip harbor.mydomain.com

# 3. Activate the machine environment
eval $(docker-machine env harbor.mydomain.com)

# 4. Transfer config files (example using remote path structure)
docker-machine ssh harbor.mydomain.com 'mkdir -p /home/<yourusername>/src/harbor/Deploy/config'
docker-machine scp -r ./config harbor.mydomain.com:$PWD

# 5. Build and start
docker-compose build
docker-compose up -d